Patient records stay inside your hospital.
Tarz HMS is multi-tenant: your subdomain maps to one organization. We describe what the product actually does — not a certificate we have not published.
One hospital per tenant
Every record carries an organization id. Application queries are scoped to the hospital on the subdomain. Staff at hospital A cannot load hospital B’s patients or invoices.
Roles instead of a shared login
Admin, doctor, nurse, receptionist, pharmacist, lab technician, and accountant each see the modules they need. A receptionist does not get the same screens as a doctor.
Encrypted in transit
Production traffic is served over HTTPS. Sessions use an httpOnly cookie rather than a token in localStorage.
Backups on paid plans
The year and six-month plans include daily encrypted database backups. Point-in-time recovery depends on the hosting database you run in production.
Audit trail
Edits to patients, prescriptions, and bills can be logged with the staff user and a timestamp so a hospital can see who changed what.
Standards we design toward
Records and identifiers are shaped so a hospital can work toward ABDM-style digital health workflows. We do not claim ISO 27001 or HIPAA certification on this page. If you need a written security questionnaire for procurement, write to us from the contact page.
Ask us how isolation works on a live tenant.
We can walk through a subdomain, a staff role, and what that user is allowed to open.